bullxsnipermarks[.]media

Analysis indicates that the domain bullxsnipermarks.media was registered on 24 February 2026 through NiceNIC International Group Co., Limited. The site resolves to the IPv4 address 94.183.234.240, which is assigned to AS56971 Cloud in Finland. The authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com, both typical of shared hosting services. An HTTPS certificate issued by Let’s Encrypt (E7) is present, confirming that the server accepts encrypted connections but offering no validation of the site’s legitimacy. The sole visible page title, “BULLX SniperMark – Advanced Trading Intelligence for BULLX.io,” suggests an attempt to masquerade as an analytics service for the BULLX.io platform, a known cryptocurrency or trading brand.

No additional page content has been captured, so the exact phishing vector (credential harvest, malicious download, etc.) cannot be confirmed. Detection telemetry shows that the domain is listed on one public security blocklist and has been flagged by PhishDestroy. VirusTotal analysis returned 2 detections out of 93 scanned vendors, indicating that at least two security products consider the domain malicious. The underlying web stack is identified as Ubuntu running Nginx, a common configuration for illicit hosting.

Given the combination of recent registration, Finnish cloud hosting, the brand‑specific title, and existing security listings, the domain should be treated as an elevated‑risk phishing indicator. Defensive actions include adding bullxsnipermarks.media to network‑level block lists, preventing DNS resolution to 94.183.234.240, and monitoring for any outbound connections to that IP. Security teams should also watch for related subdomains under the same nameservers or ASN, and consider sharing the indicator with threat‑intelligence feeds. At present, no further forensic artifacts are available, and the precise payload or user‑impact remains unknown.